Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\servicess
- <SYSTEM32>\tasks\lsassl
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\explorere
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\winlogonw
- <SYSTEM32>\tasks\smsss
- <SYSTEM32>\tasks\mdmm
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\system
- <SYSTEM32>\tasks\systems
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\services
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
Modifies file system
Creates the following files
- C:\totalcmd\language\csrss.exe
- <Current directory>\winlogon.exe
- <Current directory>\cc11b995f2a76d
- %TEMP%\ieenewsr5c
- %TEMP%\bxskvmu9og.bat
- nul
- %TEMP%\l2lnocvzxl
- C:\users\default user\cc11b995f2a76d
- %TEMP%\hqfz0hom3t
- %TEMP%\zruvtpck7q
- %TEMP%\br9xqvbdhi
- %TEMP%\skpb0jmago
- %TEMP%\drylutydef
- %TEMP%\u081o8kb9p
- %TEMP%\aybtekncet
- C:\totalcmd\language\services.exe
- C:\totalcmd\language\c5b4cb5e9653cc
- <Current directory>\6203df4a6bafc7
- <Current directory>\lsass.exe
- C:\far2\documentation\rus\9db6e019d4f04e
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\system.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\27d1bcfc3c54e0
- C:\far2\plugins\tmppanel\mdm.exe
- C:\far2\plugins\tmppanel\559fba5f8e4410
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\smss.exe
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\69ddcba757bf72
- %TEMP%\xt3ydhg7ic
- %TEMP%\i8oftlehxs
- C:\users\default user\winlogon.exe
- %ProgramFiles%\ccsetmgr\7a0fd90576e088
- C:\users\public\favorites\iexplore.exe
- C:\users\public\favorites\9db6e019d4f04e
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\iexplore.exe
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\9db6e019d4f04e
- C:\far2\documentation\rus\iexplore.exe
- C:\totalcmd\language\886983d96e3d3e
- %ProgramFiles%\ccsetmgr\explorer.exe
- %TEMP%\ihathakuvh
Deletes the following files
- %TEMP%\ieenewsr5c
- %TEMP%\l2lnocvzxl
- %TEMP%\hqfz0hom3t
- %TEMP%\i8oftlehxs
- %TEMP%\zruvtpck7q
- %TEMP%\br9xqvbdhi
- %TEMP%\skpb0jmago
- %TEMP%\drylutydef
- %TEMP%\u081o8kb9p
- %TEMP%\aybtekncet
- %TEMP%\xt3ydhg7ic
- %TEMP%\ihathakuvh
Network activity
Connects to
- '62.##9.23.193':80
TCP
HTTP GET requests
- http://62.##9.23.193/Sql/3/multiLine9/Vm3/8Longpoll/5private0/lowLine/BigloadServerSqllinuxasync.php?yc##########################################################################################...
- http://62.##9.23.193/Sql/3/multiLine9/Vm3/8Longpoll/5private0/lowLine/BigloadServerSqllinuxasync.php?iK##########################################################################################...
UDP
- 'localhost':123
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\totalcmd\LANGUAGE\csrss.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\System.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Far2\Plugins\TmpPanel\mdm.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles%\ccSetMgr\explorer.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Favorites\iexplore.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Far2\Documentation\rus\iexplore.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Current directory>\lsass.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\totalcmd\LANGUAGE\services.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Current directory>\winlogon.exe'
- 'C:\users\default user\winlogon.exe'
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\bxSkVmu9OG.bat"' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\totalcmd\LANGUAGE\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 5 /tr "'C:\Far2\Documentation\rus\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Far2\Documentation\rus\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 12 /tr "'C:\Far2\Documentation\rus\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'<Current directory>\lsass.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'<Current directory>\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'<Current directory>\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\totalcmd\LANGUAGE\services.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\totalcmd\LANGUAGE\services.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'<Current directory>\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'<Current directory>\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'<Current directory>\winlogon.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Full path to file>'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\smss.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\iexplore.exe'
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\bxSkVmu9OG.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\smss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\totalcmd\LANGUAGE\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\System.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 7 /tr "'C:\Far2\Plugins\TmpPanel\mdm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'C:\Far2\Plugins\TmpPanel\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 6 /tr "'C:\Far2\Plugins\TmpPanel\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Users\Public\Favorites\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\ccSetMgr\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'%ProgramFiles%\ccSetMgr\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 13 /tr "'%ProgramFiles%\ccSetMgr\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Favorites\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Favorites\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
